Mitigating risk for hands-free interactions

ABSTRACT

A method by an access device comprising obtaining a first biometric sample of a user; generating a first biometric template or a derivative thereof from the first biometric sample; transmitting the first biometric template or the derivative thereof to a mobile device, wherein the mobile device or the user determines if the access device is an authentic access device; receiving a confirmation of a match between the first biometric template and a second biometric template on the mobile device; and conducting a transaction between the access device and the mobile device, after the mobile device or the user determines that the access device is authentic.

CROSS-REFERENCES TO RELATED APPLICATIONS

This application is a non-provisional of and claims the benefit of thefiling date of U.S. Patent Application No. 62/572,019, filed on Oct. 13,2017, which is herein incorporated by reference in its entirety for allpurposes.

BACKGROUND

In hands-free interactions, a user may enroll their biometrics (e.g., afingerprint or a facial image) on an application on a mobile device suchas a mobile phone. When the user is at a physical location of a resourceprovider (e.g., a store or a secure location) that participates inhands-free interactions, the mobile device can detect the presence of abeacon device. The beacon device can initiate a Bluetooth Low Energy(BLE) connection and data transfer process with the mobile device at theresource provider. When the user attempts to access a resource at theresource provider, a biometric sample of the user can be captured by anaccess device. The biometric sample captured by the access device may beprovided by the access device to the mobile device via the beacondevice. A secure match can take place between the biometric templatecreated from the sample obtained by the access device and an enrolledbiometric template on the mobile device. If there is a match, the accessdevice can allow the user to access the resource.

There are some potential problems associated with this procedure. Forexample a rogue hacker could potentially reverse engineer the accessdevice application operating on the access device. The rogue hacker maysubsequently modify the application to work on a mobile phone (ratherthan on the legitimate access device) with a back-facing camera. Therogue hacker can then use the rogue application to detect an enrolleduser (“a victim”) via BLE, thereby simulating the operation of alegitimate access device. The rogue hacker can then start the hands-freeprotocol with the victim's mobile device, and may stand within 10-20feet of the victim for the required time (e.g., 20-30 secs) until theinitial data communication exchange between the victim's mobile deviceand the rogue hacker's device has been completed. The rogue hacker canthen take a picture of the victim (with or without consent), and therogue application on the rogue hacker's device can interact with thevictim's application on the victim's mobile device to complete thebiometric matching process. Then, assuming that the photo matches thebiometric template that the user enrolled with, the rogue hacker'sdevice can obtain the sensitive credentials from the victim's mobilephone. For example, the sensitive credentials may include a paymentaccount number, an access badge number or any other sensitiveinformation on the victim's mobile phone.

In some cases, once the hacker's mobile device has the sensitivecredentials, the hacker's mobile device can initiate a paymenttransaction with the victim's device, and then post the transaction toan acquirer computer. The rogue hacker could potentially obtain thefunds for the transaction from the acquirer computer (assuming it wasapproved by an authorizing entity such as issuer), before the victimdisputes the transaction.

Embodiments of the invention address these and other problems,individually and collectively.

SUMMARY

Embodiments of the invention include methods and systems for mitigatingrisk in hands-free interactions involving the use of biometrics.

One embodiment of the invention is directed to a method comprising:obtaining, by an access device, a first biometric sample of a user;generating, by the access device, a first biometric template or aderivative thereof from the first biometric sample; transmitting, by theaccess device, the first biometric template or the derivative thereof toa mobile device, wherein the mobile device or the user determines if theaccess device is an authentic access device; receiving, by the accessdevice, a confirmation of a match between the first biometric templateand a second biometric template on the mobile device; and conducting atransaction between the access device and the mobile device, after themobile device or the user determines that the access device isauthentic.

Another embodiment of the invention is directed to an access devicecomprising: access device comprising: a processor; and a computerreadable medium. The computer readable medium comprises code executableby the processor to cause the access device to perform a method. Themethod comprises obtaining a first biometric sample of a user,generating a first biometric template or a derivative thereof from thefirst biometric sample, transmitting the first biometric template or thederivative thereof to a mobile device, wherein the mobile device or theuser determines if the access device is an authentic access device,receiving a confirmation of a match between the first biometric templateand a second biometric template on the mobile device, and responsive tothe confirmation, conducting a transaction between the access device andthe mobile device, after the mobile device or the user determines thatthe access device is authentic.

Another embodiment of the invention includes a method includingreceiving, by a mobile device, a first biometric template of a user orthe derivative thereof from an access device; determining, by the mobiledevice, if the access device is an authentic access device; determining,by the mobile device, that the first biometric template and a secondbiometric template on the mobile device match; transmitting, by themobile device to the access device, a confirmation of the match betweenthe first biometric template and a second biometric template on themobile device; and conducting a transaction between the access deviceand the mobile device, after the mobile device or the user determinesthat the access device is authentic.

Another embodiment of the invention is directed to a processor; and acomputer readable medium coupled to the processor. The computer readablemedium comprises code, executable by the processor, to implement amethod. The method comprises receiving, by a mobile device, a firstbiometric template of a user or the derivative thereof from an accessdevice; determining, by the mobile device, if the access device is anauthentic access device; determining, by the mobile device, that thefirst biometric template and a second biometric template on the mobiledevice match; transmitting, by the mobile device to the access device, aconfirmation of the match between the first biometric template and asecond biometric template on the mobile device; and conducting atransaction between the access device and the mobile device, after themobile device or the user determines that the access device isauthentic.

Further details regarding embodiments of the invention can be found inthe Detailed Description and the Figures.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a diagram of a method according to an embodiment of theinvention.

FIG. 2 shows a diagram of a method according to an embodiment of theinvention.

FIG. 3 shows a diagram of a method according to an embodiment of theinvention.

FIG. 4 shows a flow diagram illustrating a method according to anembodiment of the invention.

FIG. 5 shows a flow diagram illustrating another method according toembodiment of the invention.

FIG. 6 shows a flow diagram illustrating another method according toembodiment of the invention.

FIG. 7 shows a block diagram of an access device according to anembodiment of the invention.

FIG. 8 shows a block diagram of a mobile device according to anembodiment of the invention.

DETAILED DESCRIPTION

Prior to discussing embodiments of the invention, some terms can bedescribed in further detail.

A “server computer” may include a powerful computer or cluster ofcomputers. For example, a server computer can be a large mainframe, aminicomputer cluster, or a group of servers functioning as a unit. Inone example, the server computer may be a database server coupled to aWeb server. The server computer may comprise one or more computationalapparatuses and may use any of a variety of computing structures,arrangements, and compilations for servicing the requests from one ormore client computers.

A “memory” may be any suitable device or devices that can storeelectronic data. A suitable memory may comprise a non-transitorycomputer readable medium that stores instructions that can be executedby a processor to implement a desired method. Examples of memories maycomprise one or more memory chips, disk drives, etc. Such memories mayoperate using any suitable electrical, optical, and/or magnetic mode ofoperation.

A “processor” may refer to any suitable data computation device ordevices. A processor may comprise one or more microprocessors workingtogether to accomplish a desired function. The processor may include aCPU that comprises at least one high-speed data processor adequate toexecute program components for executing user and/or system-generatedrequests. The CPU may be a microprocessor such as AMD's Athlon, Duronand/or Opteron; IBM and/or Motorola's PowerPC; IBM's and Sony's Cellprocessor; Intel's Celeron, Itanium, Pentium, Xeon, and/or XScale;and/or the like processor(s).

A “user” may be a person or thing that employs some other thing for somepurpose. A user may include an individual that may be associated withone or more personal accounts and/or mobile devices. The user may alsobe referred to as a cardholder, account holder, or consumer in someembodiments.

An “access device” may be any suitable device for communicating with amerchant computer or payment processing network, and for interactingwith a payment device, a user computer apparatus, and/or a user mobiledevice. An access device may generally be located in any suitablelocation, such as at the location of a merchant. An access device may bein any suitable form. Some examples of access devices include POSdevices, cellular phones, PDAs, personal computers (PCs), tablet PCs,hand-held specialized readers, set-top boxes, electronic cash registers(ECRs), automated teller machines (ATMs), virtual cash registers (VCRs),kiosks, security systems, access systems, Websites, and the like. Anaccess device may use any suitable contact or contactless mode ofoperation to send or receive data from, or associated with, a paymentdevice and/or a user mobile device. In some embodiments, where an accessdevice may comprise a POS terminal, any suitable POS terminal may beused and may include a reader, a processor, and a computer-readablemedium. A reader may include any suitable contact or contactless mode ofoperation. For example, exemplary card readers can include radiofrequency (RF) antennas, optical scanners, bar code readers, or magneticstripe readers to interact with a payment device and/or mobile device.The access device may also have a biometric reader capable of readingany of the biometric samples described herein or otherwise.

In some embodiments, an access device may include a BLE station. Forexample, in some embodiments, an access device may include a POSterminal and a BLE station or beacon device in communication with eachother. The access device may be present at a resource provider location.

An “access network” may refer to a network associated with an accessdevice. An access network may include an array of devices which supportthe access device by providing some needed functionality. For example,an access network may be an array of antennas or beacons designed tocommunicate with a collection of mobile devices on behalf of the accessdevice.

A “terminal ID” can be an identifier or identification associated withan access device. For example, the terminal ID may be a set ofalphanumeric characters. The terminal ID may be in any suitable format.

A “geo-location” can be a location in either the physical or virtualworld. For example, a geo-location may be a county, region, city,address, postal/zip code, latitude and longitude, time zone, building,IP address, web address, domain, and/or the like.

An “authorizing entity” is an entity which can authorize or approveinteractions. An authorizing entity may typically refer to a businessentity (e.g., a bank) that maintains an account for a user and iscapable of authorizing interactions such as payment transactions, forexample the purchase of goods or services.

An “interaction” can be a reciprocal action, effect, or influence. Aninteraction, for example, could be an exchange or transaction betweentwo or more parties.

A “key” may refer to a piece of information that is used in acryptographic algorithm to transform input data into anotherrepresentation. A cryptographic algorithm can be an encryption algorithmthat transforms original data into an alternate representation, or adecryption algorithm that transforms encrypted information back to theoriginal data. Examples of cryptographic algorithms may include tripledata encryption standard (TDES), data encryption standard (DES),advanced encryption standard (AES), etc.

An “acquirer” may typically be a business entity (e.g., a commercialbank) that has a business relationship with a particular merchant orother entity. Some entities can perform both issuer and acquirerfunctions. Some embodiments may encompass such single entityissuer-acquirers. An acquirer may operate an acquirer computer, whichcan also be generically referred to as a “transport computer”.

An “authorization request message” may be an electronic message that issent to a payment processing network and/or an issuer of a payment cardto request authorization for a transaction. An authorization requestmessage according to some embodiments may comply with ISO 8583, which isa standard for systems that exchange electronic transaction informationassociated with a payment made by a consumer using a payment device orpayment account. The authorization request message may include an issueraccount identifier that may be associated with a payment device orpayment account. An authorization request message may also compriseadditional data elements corresponding to “identification information”including, by way of example only: a service code, a CVV (cardverification value), a dCVV (dynamic card verification value), anexpiration date, etc. An authorization request message may also comprise“transaction information,” such as any information associated with acurrent transaction, such as the transaction amount, merchantidentifier, merchant location, etc., as well as any other informationthat may be utilized in determining whether to identify and/or authorizea transaction.

An “authorization response message” may be an electronic message replyto an authorization request message generated by an issuing financialinstitution or a payment processing network. The authorization responsemessage may include, by way of example only, one or more of thefollowing status indicators: Approval—transaction was approved;Decline—transaction was not approved; or Call Center—response pendingmore information, merchant must call the toll-free authorization phonenumber. The authorization response message may also include anauthorization code, which may be a code that a credit card issuing bankreturns in response to an authorization request message in an electronicmessage (either directly or through the payment processing network) tothe merchant's access device (e.g. POS equipment) that indicatesapproval of the transaction. The code may serve as proof ofauthorization. As noted above, in some embodiments, a payment processingnetwork may generate or forward the authorization response message tothe merchant.

An “electronic wallet” or “digital wallet” can store user profileinformation, payment information, bank account information, and/or thelike and can be used in a variety of transactions, such as but notlimited to eCommerce, social networks, money transfer/personal payments,mobile commerce, proximity payments, gaming, and/or the like for retailpurchases, digital goods purchases, utility payments, purchasing gamesor gaming credits from gaming websites, transferring funds betweenusers, and/or the like.

A “mobile device” (sometimes referred to as a mobile communicationdevice) may comprise any electronic device that may be transported andoperated by a user, which may also provide remote communicationcapabilities to a network. Examples of remote communication capabilitiesinclude using a mobile phone (wireless) network, wireless data network(e.g. 3G, 4G or similar networks), Wi-Fi, Bluetooth, Bluetooth LowEnergy (BLE), Wi-Max, or any other communication medium that may provideaccess to a network such as the Internet or a private network. Examplesof mobile devices include mobile phones (e.g. cellular phones), PDAs,tablet computers, net books, laptop computers, wearable devices (e.g.,watches), vehicles such as automobiles and motorcycles, personal musicplayers, hand-held specialized readers, etc. A mobile device maycomprise any suitable hardware and software for performing suchfunctions, and may also include multiple devices or components (e.g.when a device has remote access to a network by tethering to anotherdevice—i.e. using the other device as a modem—both devices takentogether may be considered a single mobile device). A mobile device mayalso comprise a verification token in the form of, for instance, asecured hardware or software component within the mobile device and/orone or more external components that may be coupled to the mobiledevice. A detailed description of a mobile device is provided below.

A “payment account” (which may be associated with one or more paymentdevices) may include an account that can be used to pay for goods orservices A suitable payment account may include a credit card account, achecking account, or a prepaid account.

A “payment device” may include a device that may be used to conduct afinancial transaction, such as to provide payment information to amerchant. A payment device may be in any suitable form. For example,suitable payment devices can be hand-held and compact so that they canfit into a consumer's wallet and/or pocket (e.g., pocket-sized) and maybe in the form of a mobile device as described above. They may includesmart cards, magnetic stripe cards, keychain devices (such as theSpeedpass™ commercially available from Exxon-Mobil Corp.), etc. Otherexamples of payment devices include cellular phones, personal digitalassistants (PDAs), pagers, payment cards, security cards, access cards,smart media, transponders, 2-D barcodes, an electronic or digitalwallet, and the like. Such devices can operate in either a contact orcontactless mode.

A “biometric” may be any human characteristic that is unique to anindividual. For example, a biometric may be a person's fingerprint,voice sample, face, DNA, retina, etc.

A “biometric reader” may include a device for capturing data from anindividual's biometric sample. Examples of biometric readers may includefingerprint readers, front-facing cameras, microphones, and irisscanners.

A “biometric sample” may include data obtained by a biometric reader.The data may be either an analog or digital representation of the user'sbiometric, generated prior to determining distinct features needed formatching. For example, a biometric sample of a user's face may be imagedata. In another example, a biometric sample of a user's voice may beaudio data.

A “biometric template” or “biometric sample template” may include a filecontaining distinct characteristics extracted from a biometric samplethat may be used during a biometric authentication process. For example,a biometric template may be a binary mathematical file representing theunique features of an individual's fingerprint, eye, hand or voiceneeded for performing accurate authentication of the individual.

“Biometric data” includes data that can be used to uniquely identify anindividual based upon one or more intrinsic physical or behavioraltraits. For example, biometric data may include fingerprint data andretinal scan data. Further examples of biometric data include digitalphotographic data (e.g., facial recognition data), deoxyribonucleic acid(DNA) data, palm print data, hand geometry data, and iris recognitiondata.

A “resource providing entity” can be any entity that provides resourcesduring a transaction. For example, a resource providing entity can be amerchant, a venue operator, a building owner, a governmental entity,etc.

“User identifying information” can be any information associated with auser and that can identify the user. User identifying information caninclude, but is not limited to, a primary account number (PAN),telephone, e-mail address, zip code, mailing address, photoidentification, personal identification number (PIN), etc.

FIGS. 1-6 describe various systems and methods. The various componentsshown in the Figures may utilize a communication network. Thecommunication network may follow a suitable communication protocol togenerate one or more secure communication channels. A communicationchannel may, in some instances, comprise a “secure communicationchannel,” which may be established in any known manner, including theuse of mutual authentication and a session key and establishment of anSecure Socket Layer (SSL) session. However, any method of creating asecure channel may be used. By establishing a secure channel, sensitiveinformation may be securely transmitted.

Any suitable communications protocol may be used for generating acommunications channel. A suitable communication network may be any oneand/or the combination of the following: a direct interconnection; theInternet; a Local Area Network (LAN); a Metropolitan Area Network (MAN);an Operating Missions as Nodes on the Internet (OMNI); a secured customconnection; a Wide Area Network (WAN); a wireless network (e.g.,employing protocols such as, but not limited to a Wireless ApplicationProtocol (WAP), I-mode, and/or the like); and/or the like. Messagesbetween the computers, networks, and devices described in the figurescan be transmitted using a secure communications protocols such as, butnot limited to, File Transfer Protocol (FTP); HyperText TransferProtocol (HTTP); Secure Hypertext Transfer Protocol (HTTPS), SSL, ISO(e.g., ISO 8583) and/or the like.

For simplicity of illustration, a certain number of components are shownin each figure. It is understood, however, that embodiments of theinvention may include more than one of each component. In addition, someembodiments of the invention may include fewer than or greater than allof the components shown in the figures.

One embodiment of the invention is directed to a method comprisingobtaining, by an access device, a first biometric sample of a user, andgenerating, by the access device, a first biometric template or aderivative thereof from the first biometric sample. The method alsocomprises transmitting, by the access device, the first biometrictemplate or the derivative thereof to a mobile device. The mobile deviceor the user determines if the access device is an authentic accessdevice. The access device receives a confirmation of a match between thefirst biometric template and a second biometric template on the firstmobile device. A transaction is then conducted between the access deviceand the mobile device, after the mobile device or the user determinesthat the access device is authentic.

FIGS. 1, 2, and 3 show diagrams illustrating various aspects of one ormore systems for conducting wireless biometric authentication. Inparticular, each of the systems may be located at a resource providerlocation and may include one or more users that are at the resourceprovider location to conduct a transaction with the resource provider,where each of the users may possess a mobile device.

FIG. 1 depicts a system 100 for detecting a mobile device at a resourceprovider location. System 100 includes transmitting station 102, mobiledevice 104, and external service 106 (which may be embodied by a servercomputer). The steps depicted in FIG. 1 describe how a mobile deviceinteracts with a transmitting station of a resource provider locationprior to interacting with an access device at a resource provider toobtain a resource (e.g., prior to checkout).

Mobile device 104 may be a mobile phone that is carried by a user whilethe user is located a resource provider location. For example, the usermay be a user with a smartphone (i.e., the mobile device) that isshopping in a brick-and-mortar store (i.e., the resource providerlocation).

Transmitting station 102 may be a stationary device that is associatedwith the resource provider location. Transmitting station 102 may detectand communicate with mobile devices as they are carried to the resourceprovider location by their respective users. The communication may becarried out using a short-to-medium range wireless communicationmechanism. For example, transmitting station 102 may be a Bluetooth LowEnergy (BLE) beacon that detects the presence of a user's smartphone viaBLE as the user enters the store and sends a beacon comprising atransmitting station identifier (i.e., a Beacon ID) to the smartphone.

Although this example describes a BLE communication mechanism, it isunderstood that embodiments of the invention may utilize any suitablewireless communication mechanism. Examples of such communicationmechanisms may include the use of an suitable electrical,electromagnetic, or even acoustic mode of communication. For example,embodiments of the invention may use RF, IR, or even audio signals totransmit data to and from two devices in a wireless manner. Preferredcommunication mechanisms include short-to-medium range wirelesscommunication mechanisms. Examples of communication mechanisms mayinclude Wi-Fi, BLE, classic Bluetooth, etc.

In some embodiments, BLE technology is used as the short rangecommunication protocol or technology. Bluetooth Low Energy is a wirelesspersonal area network technology used for transmitting data over shortdistances. It is designed for low energy consumption and cost, whilemaintaining a communication range similar to classic Bluetooth. BLEcommunication consists primarily of “advertisements,” or small packetsof data, broadcast at a regular interval by beacons (which may bepresent in or be a base station) or other BLE enabled devices via radiowaves.

External service 106, which can be implemented as a cloud based systemor as a server computer system, can be remotely located with respect tothe resource provider location. Mobile device 104 may use externalservice 106 as a trusted service (which may be merchant or paymentprocessor drive) to translate a transmitting station identifier to anidentification of the resource provider location (i.e., a resourceprovider location identifier). Communications between mobile device 104and external 106 can be performed using any suitable communicationsnetworks. Suitable communications networks may be any one and/or thecombination of the following: a direct interconnection; the Internet; aLocal Area Network (LAN); a Metropolitan Area Network (MAN); anOperating Missions as Nodes on the Internet (OMNI); mesh networks, asecured custom connection; a Wide Area Network (WAN); a wireless network(e.g., employing protocols such as, but not limited to a WirelessApplication Protocol (WAP), I-mode, and/or the like); and/or the like.Communications may be performed using a secure communication protocolsuch as transport layer security protocol, secure sockets layerprotocol, or other suitable secure communication protocols.

As shown in FIG. 1 , mobile device 104 may be carried by the user as theuser enters the resource provider location. At this point, the mobiledevice may possess a biometric template (e.g., a second biometrictemplate) that was generated from a biometric sample of the user. Forexample, mobile device 104 may have installed on it, a smartphoneapplication that walks the user through a process of generating thebiometric template, where the mobile device takes a photo of the user'sface and generates a biometric template based on the photo. Thebiometric template may then be stored in the mobile device.

Although this example describes the use of facial images as biometricsamples, other biometric samples that may be used may include voicesamples, fingerprint samples, DNA samples, hair samples, retinal scansamples, etc.

At step S101, transmitting station 102 detects mobile device 104 as itis carried into the resource provider location. For example, a user'ssmartphone may be detected as the user enters the store. Upon sensingmobile device 104, transmitting station 102 may send a beacon to themobile device, where the beacon comprises a transmitting stationidentifier (e.g., a Beacon ID) that uniquely identifies the transmittingstation. The transmitting station identifier may be extracted from thebeacon by an application installed on mobile device 104.

In the same step, mobile device 104 and transmitting station 102 mayexchange address information (e.g., IP addresses, MAC addresses) so thatthe transmitter station and the mobile device may recognize each otherfor subsequent communications.

At step S102, mobile device 104 communicates with external service 106to identify the resource provider based on the received transmittingstation identifier. In particular, the application installed on mobiledevice 104 may transmit the transmitting station identifier to externalservice 106. If geolocation information is available (e.g., mobiledevice 104 has geo-location switched on and the user has consented tothe geolocation information being shared), the application may transmitthe geolocation information to external service 106, which would enablethe external service to catch attempts to spoof transmitting stationidentifiers.

At step S103, external service 106 responds to mobile device 104 withthe appropriate resource provider location identifier. Upon receivingthe transmitting station identifier, external service 106 may resolvethe transmitting station identifier to a resource provider locationidentifier. In some cases, this may involve resolving the transmittingstation identifier to a merchant identifier and a store identifier. Insome embodiments, the merchant identifier and the store identifier maybe referred to as a “Card Acceptor ID” (CAID) and a “Card Acceptor Name”(CAN) respectively. Any such identifiers may be used so long as theyuniquely identify the resource provider location. Once the resourceprovider location identifier is determined, the identifier istransmitted by the external service 106 back to mobile device 104.

At step S104, mobile device 104 transmits a message that comprisesseveral pieces of information to transmitting station 102. Theinformation may include an ephemeral mobile device identifier Dev_IDthat identifies mobile device 104 while it is at the resource providerlocation. In some cases, the mobile device ID may be a large randomnumber (e.g., 8 bytes) that is generated every time the mobile device iscarried to the resource provider location. In particular, each mobiledevice that enters the resource provider location may provide a mobiledevice ID that uniquely identifies the mobile device for the duration ofthe visit. The resource provider may use these mobile device IDs toidentify each mobile device and maintain consistent communication witheach of the mobile devices without mixing them up from one interactionto the next while the mobile devices are at the resource providerlocation.

The information may include the resource provider location identifier(e.g., CAID and CAN). The information may include a user identifierCust_ID that the user wishes to be known as in the store at this time.The User_ID may be permanent or only for the current visit to theresource provider location. The information may include a nonce n, whichis a random number of a certain size (e.g., 128 bits) that is generatedby mobile device 104.

In embodiments where the public-key encryption can used to securelytransfer biometric templates, the information may include a public keycertificate PKCert that is associated with mobile device 104, where thecertificate is signed by a certificate authority (CA). In suchembodiments, the resource provider (i.e., the access device) wouldpossess (or have access to) the CA's public key so that the resourceprovider would be able to verify the public key certificate of mobiledevice 104. The message may be signed using the private key of mobiledevice 104. Accordingly, in such embodiments, an example message sent bymobile device 104 to transmitting station 102 may comprise thefollowing:

-   -   Sign_(Pv){Dev_ID, Cust_ID, n, CAID, CAN}, PKCert

As can be seen in the formula above, the example message comprises thepublic key certificate PKCert, the user identifier Cust_ID, the deviceidentifier Dev_ID, the resource provider location identifier CAID andCAN, the random number n, and a signature of the Dev_ID, the Cust_ID, n,CAID, and CAN.

The public key of the user's mobile device 104 can then be used by thetransmitting station 102 or an access device associated with thetransmitting station 102 to encrypt a biometric template. The encryptedbiometric template (e.g., an encrypted first biometric template) canthen be transmitted back to the user's mobile device 104 where acomparison of the encrypted biometric template from the transmittingstation 102 and a reference biometric template on the mobile device 104can be performed to determine if the biometric templates match or not.The comparison can use homomorphic encryption or fuzzy logic matchprocesses. Alternatively, the mobile device 104 may use a private key todecrypt a received encrypted biometric template.

After step S104, mobile device 104 may store status informationcontaining the resource provider location identifier and geo-locationinformation that tells the mobile device which resource providerlocation is being visited. Accordingly, the application installed onmobile device 104 may be designed such that only transactions involvingthe resource provider location identifier can be serviced.

Upon receiving the message from mobile device 104, transmitting station102 may cause the creation of a status entry that contains informationabout the mobile device's presence at the resource provider location.Accordingly, the resource provider may maintain a status entry for eachmobile device (e.g., at a database) that is carried to the resourceprovider location. For example, each status entry may comprise theparameters Dev_ID, Cust_ID, n, and PKCert associated with a particularmobile device at the resource provider location.

When mobile device 104 nears an access device to perform a transaction,the status entry associated with the mobile device may provideinformation that is used to complete the transaction.

FIG. 2 depicts a system 200 for conducting a transaction using wirelessbiometric authentication in accordance with some embodiments. Inparticular, FIG. 2 shows users 202, 204, 206, and 208 standing in a lineto perform a transaction with access device 210. Users 202, 204, 206 and208 carry mobile devices 104, 220, 222, and 224 respectively. Thus, allof the mobile devices shown in FIG. 2 are within a proximate vicinity ofaccess device 210. It should be noted that, although FIG. 2 depicts onlymobile devices 104, 220, 222, and 224, there may be additional mobiledevices that are considered to be at the resource provider location butnot within a proximate vicinity of access device 210.

As shown in FIG. 2 , when user 202 is ready to perform a transactionwith access device 210, user 202 may stand in front of the access devicewhile mobile device 104 remains in his pocket. Access device 210 obtainsa first biometric sample of the user 202, and can generate a firstbiometric template or derivative thereof from the first biometricsample. For example, access device 210 may capture an image of the faceof user 202 and generates a first biometric template based on the image.In some cases, the access device 210 may generate the first biometrictemplate and may then generate a derivative (e.g., an encrypted versionof the first biometric template) of the first biometric template. Atthis point, access device 210 may know that it is supposed to conduct atransaction with a mobile device owned by user 202. However, accessdevice 210 may not necessarily know which of mobile devices 104, 220,222, and 224 is the mobile device carried by user 202. Accordingly,access device 210 may use the biometric template to identify the correctmobile device to complete the transaction with.

In particular, access device 210 may broadcast or transmit its biometrictemplate or derivative thereof to all nearby mobile devices in anattempt to determine which mobile device possesses a biometric templateor derivative thereof that matches the access device's biometrictemplate or derivative.

It should be noted that, in some embodiments, a first biometric templatedoes not have to be identical to a second biometric template in order to“match” the template. So long as the first biometric template is closeenough to the second biometric template (e.g., the first biometrictemplate possesses a similar number of features and/or possessesfeatures that are similar enough to that of the second biometrictemplate), the first biometric template can be considered to match thesecond biometric template for the purposes of those embodiments. In someembodiments, a “match” can be defined by a threshold matching score. Forexample, the first biometric template may correspond to a facial photoof user 202 taken by mobile device 104 while the second biometrictemplate may correspond to a facial photo of user 202 taken by accessdevice 210, where the similarities between the face shown in the firstphoto and the face shown in the second photo can be used to determine amatch between the first and second biometric templates.

When a mobile device determines a match between its stored biometrictemplate and a biometric template received in a broadcast, the mobiledevice may transmit a confirmation of a match back to access device 210.Upon receiving the confirmation, access device 210 may conduct thetransaction with the mobile device that sent the confirmation. Toconduct the transaction, the mobile device may transmit sensitivecredentials to the access device 210. Hence, through the use ofbiometric authentication, the user of the first mobile device is able toperform a secure wireless transaction without having to manuallymanipulate the first mobile device or a portable transaction device(e.g., a credit card).

As noted above, it is desirable if biometric templates are notbroadcasted in the clear, because doing so could jeopardizetransactional security and give rise to privacy concerns. After all, itcan be assumed that users would not want their facial images or otherbiometric information broadcasted openly. Thus, embodiments of theinvention may encrypt the biometric template prior to broadcasting it.Techniques for encrypting biometric templates may include the use ofpublic-key encryption, fuzzy extractors, and homomorphic encryption.

In the process described with respect to FIG. 2 , the mobile device thatis interacting with the access device needs to have assurance that it isinteracting with an authentic access device and not one operated by arogue hacker. Various methods for providing such assurance are describedbelow with respect to FIGS. 4-6 .

FIG. 3 depicts another exemplary system 300 for conducting a transactionusing wireless biometric authentication in accordance with someembodiments. In particular, FIG. 3 shows transmitting station 102,mobile device 104, external service 106, and access device 210.

Access device 210 and transmitting station 102 can be uncoupled orcoupled together. In some embodiments, access device 210 andtransmitting station 102 can be embodied by the same device. In otherembodiments, access device 210 and transmitting station 102 can beembodied by different devices that communicate with each other over anetwork (e.g., a local area network).

In FIG. 3 , steps S301, S302, S303, and S304 may correspond to stepsS101, S102, S103, and S104 respectively, and the descriptions areincorporated herein by reference, and the descriptions of those stepsneed not be repeated here.

At step S305, access device 210 may broadcast its encrypted biometrictemplate to all nearby mobile devices, including mobile device 104. Uponreceiving the broadcast, mobile device 104 may attempt to decrypt theencrypted biometric template. If the encryption attempt succeeds, mobiledevice 104 may determine whether its stored biometric template matchesthe received biometric template.

At step S306, upon determining that the biometric templates match,access device 210 transmits a confirmation of the match back to accessdevice 210. Upon receiving the confirmation, access device 210 mayconduct the transaction with mobile device 104 on behalf of user 202.After the transaction is finished, user 202 may leave while user 204,who is next in line, may stand in front of access device 210 to have hispicture taken, which restarts the mobile device identification processagain for a subsequent transaction.

As described above, if a rogue hacker has reverse engineered thesoftware on the access device 210 and attempts to simulate the functionof the access device 210 using a rogue mobile device, the rogue hacker'smobile device can be used to take a picture of a legitimate user withoutthe user's knowledge. This could potentially be used to trick thelegitimate user's mobile to perform the above-described biometricmatching process. The rogue hacker could then steal the legitimateuser's credentials to conduct unauthorized transactions.

Embodiments of the invention provide for a number of ways to mitigatethis risk, and such embodiments can be described with reference to FIGS.4-6 . It is understood that the process flows illustrated and describedwith respect to FIGS. 4-6 may be used on conjunction with the processflows illustrated and described with respect to FIGS. 1-3 .

FIG. 4 shows a flow diagram illustrating an embodiment of the invention.In some embodiments, an acquirer or other authoritative service providercan link each resource provider (e.g., merchant) access device to ageo-location and can put controls in place, such that movement of theaccess device by the resource provider will require updatedregistration. This would significantly slow down a rogue hacker'sability to simulate a legitimate access device, since the rogue hackerwould somehow need to figure out how to have the rogue mobile device'slocation match that of the legitimate access device. Even if a roguehacker with a rogue application could potentially try to and fake ageo-location, the geo-location may be determined from the mobile deviceat the time of the interaction and can be cryptographically protected,such that it cannot be modified by the rogue hacker. The tolerance as tohow much a legitimate access device can move can vary depending upon thecircumstances. For example, a food truck may have a wide tolerance, andmay allow for a low transaction limit. In contrast, a department storecan have a narrow tolerance, but can allow a high transaction limit.

The system shown in FIG. 4 comprises a mobile device 402, an accessdevice 404, and a transport computer 406. The mobile device 402 mayinclude at least a biometric reader, a processor, a memory, and acomputer readable medium capable of executing code. A mobile deviceapplication may be located on the mobile device 402 and may be capableof being executed by the mobile device 402. The access device 404 mayinclude at least a biometric reader, a processor, a memory, and acomputer readable medium capable of executing code. An access deviceapplication may be located on the access device 404 and be capable ofbeing executed by the access device 404.

The transport computer 406 may be a server computer including at least aprocessor, a memory, and a computer readable medium capable of executingcode. In some embodiments, the transport computer 406 may be operated bya service provider. For example, in some embodiments, the transportcomputer 406 may be an acquirer computer operated by an acquirer. Theacquirer computer may be in communication with a payment processingnetwork, and an authorizing entity computer such as an issuer computer(not shown).

In FIG. 4 , steps S402-S412 may occur in a set up phase before themobile device 402 interacts with the access device 404. Steps S414-S426may occur during a specific interaction between a mobile device 402 andthe access device 404.

At steps S402 and S404, the access device 404 may generate and transmita request to the transport computer 406, requesting a certificatecomprising at least a terminal ID and a geo-location of the accessdevice 404. In some embodiments, the request may also include atimestamp, a resource provider ID, and/or any other suitable identifyinginformation. The certificate request may be signed with a cryptographickey such as an access device 404 private key. The geo-location may bethe location of the access device 404 and may be expressed in anysuitable manner, including latitude and longitude. In some embodiments,the terminal ID may be generated by the access device 404 and thentransmitted to the transport computer 406. In other embodiments, thetransport computer 406 may generate the terminal ID to identify theintended geo-location of the access device 404 and assign it to theaccess device 404.

At step S406, the transport computer 406 may receive the request toregister the access device 404, may link the access device 404 to aspecific geo-location, and may then put controls in place. If an ownerof the access device 404 wants to move the access device 404 to a newlocation, then they will need to register it at the new geo-location.

At step S408, after the transport computer 406 determines the accessdevice 404 and its geolocation, the transport computer 406 may generatea digital certificate including the geolocation of the access device404. In step S410, the transport computer 406 may then transmit thecertificate to the access device 404.

In step S412, the access device 404 may receive the digital certificate.In step S414, the access device 404 may, after an interaction has beeninitiated, transmit the certificate to the mobile device 402. Thedigital certificate may be transmitted from the access device 404 to themobile device 402 in a communication similar to the communication S305in FIG. 3 .

At step S416, the mobile device 402 may receive the digital certificate.At step S418, the mobile device 402 may compare the geo-location fromthe certificate to the geo-location of the mobile device 402. The mobiledevice 402 may determine its geolocation by using a locationdetermination system such as a GPS system. If the two geo-locationsmatch or are otherwise proximate to each other, then the mobile device402 may determine that the access device 404 is an authentic accessdevice and is not a rogue device, and can then decide to continue withthe interaction. In some embodiments, the degree of proximity can beless than about 5 feet, 3 feet, or 1 foot in embodiments of theinvention.

At step S420, the mobile device 402 and the access device 404 maycontinue with the interaction, after the mobile device 402 hasdetermined that the access device 404 is authentic. In some embodiments,to continue with the interaction, the mobile device 402 may provide thecredentials stored on it to the access device 404. In step S422, theaccess device 404 may receive the credentials, and then may initiate afurther interaction with the credentials at step S424. In someembodiments, the access device 404 may generate an authorization requestmessage including the credentials and may transmit the authorizationrequest message to the transport computer 406.

At step S426, the transport computer 406 may transmit the authorizationrequest message to a processing computer such as a payment processingnetwork (not shown). The payment processing network may then transmitthe authorization request message to an authorizing entity computer(e.g., an issuer computer), which may authorize or decline thetransaction. The authorizing entity computer may then return anauthorization response message to the access device 404 via thetransport computer 406 and the processing network computer. At the endof the day or at any other suitable period of time, a settlement processtakes place between the transport computer, the authorizing entitycomputer, and the processing computer.

In some embodiments, after a biometric match has been confirmed by themobile device 402, in step S418 above, the user application on themobile device 402 can be set to provide an alert. For example, the alertmay be a vibration or a buzz. In some embodiments, the alert may be anaudible sound, a flash of light, or any other suitable alert. This woulddeter a fraudster or rogue hacker, and alert the victim whose picture isbeing captured.

FIG. 5 shows another embodiment of the invention, which can provideassurance to a mobile device and its user that is it interacting with anauthentic access device. The method illustrated in FIG. 5 may use of apublic key infrastructure to establish the authenticity of the accessdevice 504. The public key infrastructure can be established, with thetransport computer 506, or other suitable entity or computer such as aprocessor computer, controlling the issuance and revocation ofcertificates. The transport computer 506 may block an access device 504,if the access device 504 has been discovered to be rogue, by revoking apreviously issued certificate, rather than simply not paying theoperator of the access device 504. The certificates can be issued to anypart of the owner or operator of the access device's infrastructure asdescribed below.

In some embodiments, an access device and/or a BLE station or beacon(which may be considered part of an access device in some embodiments)may authenticate with public key technology to the mobile device 502.The transport computer 506 may control the issuance and revocation ofcertificates. In some embodiments, digital certificates may be deliveredover-the-air by the transport computer 506 to the access device 504. Insome embodiments the access device and/or the BLE station may bemanufactured or produced with the certificate. The mobile device 502 maycheck for the possible revocation of devices either from a CertificateRevocation List or from an online certificate status protocol (OCSP)responder.

The public key infrastructure at the mobile device 502 contains acertificate authority public key. The public key infrastructure at theaccess device 504 contains a certified access device public key and anaccess device private key.

In some embodiments, the mobile device 502 and the access device 504 mayset up a trusted connection using the access device private key and thecertified access device public key, as well as (for validating thecertificate) the certificate authority public key resident in the mobiledevice 502. The access device 504 may be in communication with the BLEstation. In some embodiments, the BLE station may be a component on theaccess device 504.

At steps S502 and S504, the access device 504 may generate and transmita request to the transport computer 506, requesting a certificatecomprising at least a terminal ID of the access device 504. In someembodiments, the request may also include a timestamp, a resourceprovider ID, and/or any other suitable identifying information. Thecertificate request may be signed with a cryptographic key such as anaccess device private key.

At step S506, the transport computer 506 may receive, the request toregister the access device 504. At step S508, after the transportcomputer 406 may generate a digital certificate for the access device504. The digital certificate may include a digital signature using acertificate authority private key. In step S510, the transport computer506 may then transmit the certificate to the access device 504. In stepS512, the access device 504 may receive and store the digitalcertificate.

At some point in time, the mobile device 502 may receive a certificateauthority public key when an application that is used to conducttransactions is downloaded to the mobile device 502. The access device504 including the BLE station (e.g., a BLE beacon) and mobile device 502may establish communication with each other.

In step S513, the mobile device 502 may provide a challenge to theaccess device/BLE station so that the mobile device 502 may verify ifthe access device/BLE station is rogue or not. In step S514, the accessdevice/BLE station may receive and sign the challenge with the accessdevice 504 private key to create a digital signature. In step S515, theaccess device/BLE station may transmit the signed challenge along withthe access device digital certificate to the mobile device 502. In step516, the mobile device 502 may receive the signed challenge and theaccess device digital certificate. The mobile device 502 may verify theaccess device digital certificate in step S518 by using the certificateauthority public key, and may then use the certified access devicepublic key from the digital certificate to validate the signedchallenge. In some embodiments, the challenge may be a new challengeevery time.

At steps S520-S526, the interaction proceeds between the mobile device502 and the access device 504 if the challenge is successfully signedand the digital certificate is verified. The mobile device 502 mayprovide the credentials stored on it to the access device 504. In stepS522, the access device 504 may receive the credentials, and then mayinitiate a further interaction with the credentials at step S524. Insome embodiments, the access device 504 may generate an authorizationrequest message including the credentials and may transmit theauthorization request message to the transport computer 506.

At step S526, the transport computer 506 may transmit the authorizationrequest message to a processing computer such as a payment processingnetwork (not shown). The payment processing network may then transmitthe authorization request message to an authorizing entity computer(e.g., an issuer computer), which may authorize or decline thetransaction. The authorizing entity computer may then return anauthorization response message to the access device 504 via thetransport computer 506 and the processing network computer. At the endof the day or at any other suitable period of time, a settlement processtakes place between the transport computer, the authorizing entitycomputer, and the processing computer.

FIG. 6 shows another embodiment of the invention, which can provideassurance to a mobile device and its user that it is interacting with anauthentic access device. The system shown in FIG. 6 may comprise amobile device 602, an access device 604, and a transport computer 606.The embodiment illustrated in FIG. 6 may include the use of a secondaryaudio signal that can be added to the hands-free protocol, e.g. overaudio, where the access device 604 may emit an audible sound. The mobiledevice 602 may receive, identify, and authenticate the audio signalbefore engaging in a further interaction with the access device 604. Inthis way, the user of the mobile device 602 would be alerted to theinteraction that is happening with the mobile device 602. In someembodiments of the invention, the sound can be generic for all users, orcould be set for each individual user (i.e. “Thank you for paying withVisa Hands-Free John!”).

At step S602, the access device 604 may generate and transmit aconfirmation signal, after the mobile device 602 and the access device604 have formed a connection via, for example, BLE. The confirmationsignal may be any signal, such as an acoustic or audible sound pattern,or audio signal capable of being heard by a person. In some embodiments,the confirmation signal may be the same for every mobile device 602. Inother embodiments, the confirmation signal may be individualized foreach mobile device 602, such as “Thank you for paying with VisaHands-Free John!” In some embodiments, the access device 604 maytransmit another signal to the mobile device 602, wherein the signal maybe over BLE, Wi-Fi, etc.

At step S604, the mobile device 602 may receive and detect theconfirmation signal. In some embodiments, if the mobile device 602 doesnot detect the confirmation signal, then no interaction will take place.Once received, the mobile device 602 may determine that the audio signalis present, and may initiate further interaction. In this embodiment,the user may hear the audio signal and be alerted that a transaction istaking place. Thus, if the user is not conducting a transaction, theuser can be alerted that a potential transaction is being conducted withtheir mobile device 602. In some cases, after receiving the confirmationaudio signal, the mobile device 602 could play yet another audio signalsuch as (“Your welcome!”) to further alert the user that a transactionis being conducted with the mobile device 602.

At step S608, the mobile device 602 may initiate a further interactionwith the access device 604. For example, the mobile device 602 mayprovide sensitive credentials to the access device 604. At step S610,the access device 604 may receive the credentials, and in step S612 mayinitiate a further interaction with the credentials. In someembodiments, the access device 604 may generate an authorization requestmessage including the credentials and may transmit the authorizationrequest message to the transport computer 606.

At step S614, the transport computer 606 may transmit the authorizationrequest message to a processing computer such as a payment processingnetwork (not shown). The payment processing network may then transmitthe authorization request message to an authorizing entity computer(e.g., an issuer computer), which may authorize or decline thetransaction. The authorizing entity computer may then return anauthorization response message to the access device 604 via thetransport computer 606 and the processing network computer. At the endof the day or at any other suitable period of time, a settlement processtakes place between the transport computer, the authorizing entitycomputer, and the processing computer.

While the method illustrated in FIG. 6 may be a standalone method usedin conjunction with the process illustrated in FIG. 3 , the stepsS602-S606 could optionally be used in conjunction with steps S416-S420in FIG. 4 or steps S516-S520 in FIG. 5 (each of which may also includesteps from FIG. 3 ).

Embodiments of the invention provide for a number of advantages. Each ofthe various embodiments described above helps to ensure that the mobiledevice and the user using the mobile device is interacting with alegitimate access device. The mobile device can confirm the authenticityof the mobile device using a geolocation comparison, a public-privatekey cryptographic infrastructure and/or an audio signal that can beprocessed by the mobile device. As such, embodiments of the inventionhelp to ensure that the mobile device does not provide securecredentials to an unauthorized access device.

Although the examples above specifically discuss payment transactions,embodiments of the invention are not limited to payment transactions.For example, the wireless biometric authentication techniques describedabove can be used to access a resource provided by any suitable resourceproviding entity. Other examples of resources that can be accessed usingthe authentication processes according to embodiments of the inventioninclude access to a venue, access to information, etc.

FIG. 7 illustrates a block diagram of an access device 701, according tosome embodiments. Access device 701 may include device hardware 704coupled to a memory 702. Device hardware 704 may include a processor704A, a communications subsystem 704C, user interface 704B, and abiometric reader 704D. Processor 704A can be implemented as one or moreintegrated circuits (e.g., one or more single core or multicoremicroprocessors and/or microcontrollers), and is used to control theoperation of portable communication device 701. Processor 704A canexecute a variety of programs in response to program code orcomputer-readable code stored in memory 702, and can maintain multipleconcurrently executing programs or processes. Communications subsystem704C may include one or more RF transceivers and/or connectors that canbe used by portable communication device 701 to communicate with otherdevices and/or to connect with external networks. User interface 704Bcan include any combination of input and output elements to allow a userto interact with and invoke the functionalities of portablecommunication device 701. A biometric reader 704D may be present tocapture biometrics of users.

Memory 702 can be implemented using any combination of any number ofnon-volatile memories (e.g., flash memory) and volatile memories (e.g.,DRAM, SRAM), or any other non-transitory storage medium, or acombination thereof media. Memory 702 may store a number of softwarecomponents or modules including a digital certificate processing module702A, a geolocation module 702B, an audio signal generation module 702C,cryptographic keys 702D, a biometrics processing module 702E, and an OS(operating system) 702F. Each of the software components can be executedby processor 705.

In some embodiments, the memory 702 can include a non-transitorycomputer readable medium comprising code, executable by the processorfor implementing a method comprising: obtaining, by an access device, afirst biometric sample of a user; generating, by the access device, afirst biometric template or a derivative thereof from the firstbiometric sample; transmitting, by the access device, the firstbiometric template or the derivative thereof to a mobile device, whereinthe mobile device determines or the user if the access device is anauthentic access device; receiving, by the access device, a confirmationof a match between the first biometric template and a second biometrictemplate on the first mobile device; and conducting a transactionbetween the access device and the mobile device, after the mobile deviceor the user determines that the access device is authentic.

FIG. 8 illustrates a block diagram of a mobile device in the form of aportable communication device 801, according to some embodiments.Portable communication device 801 may include device hardware 804coupled to a memory 802. Device hardware 804 may include a processor804A, a communications subsystem 804C, user interface 804B, and abiometric reader 804D. Processor 804A can be implemented as one or moreintegrated circuits (e.g., one or more single core or multicoremicroprocessors and/or microcontrollers), and is used to control theoperation of portable communication device 801. Processor 804A canexecute a variety of programs in response to program code orcomputer-readable code stored in memory 802, and can maintain multipleconcurrently executing programs or processes. Communications subsystem804C may include one or more RF transceivers and/or connectors that canbe used by portable communication device 801 to communicate with otherdevices and/or to connect with external networks. User interface 804Bcan include any combination of input and output elements (e.g., adisplay, speaker, or microphone) to allow a user to interact with andinvoke the functionalities of portable communication device 801. Abiometric reader 804D may be present to capture biometrics of users.

Memory 802 can be implemented using any combination of any number ofnon-volatile memories (e.g., flash memory) and volatile memories (e.g.,DRAM, SRAM), or any other non-transitory storage medium, or acombination thereof media. Memory 802 may store a number of softwarecomponents including a digital certificate processing module 802A, ageolocation module 802B, an audio signal processing module 802C,cryptographic keys 802D, a biometrics processing module 802E, and anoperating system 802F. The memory 802 may also include applications suchas payment application such as a mobile wallet application, a merchantapplication, a mobile location application, etc. These softwarecomponents may be executed by the processor 805.

The memory may comprise a non-transitory computer readable mediumcomprising code, executable by the processor 804A to implement a methodcomprising: receiving, by a mobile device, a first biometric template ofa user or a derivative thereof from an access device; determining, bythe mobile device, if the access device is an authentic access device;determining, by the mobile device, that the first biometric template anda second biometric template on the mobile device match; transmitting, bythe mobile device to the access device, a confirmation of the matchbetween the first biometric template and a second biometric template onthe mobile device; and conducting a transaction between the accessdevice and the mobile device, after the mobile device or the userdetermines that the access device is authentic.

Further details regarding fuzzy logic and biometric matching processescan be found in PCT Publication No. WO 2017/075063 corresponding toApplication No. PCT/US2016/058880, filed on Oct. 26, 2016, which isherein incorporated by reference in its entirety for all purposes.

It should be understood that any of the embodiments of the presentinvention can be implemented in the form of control logic using hardware(e.g. an application specific integrated circuit or field programmablegate array) and/or using computer software with a generally programmableprocessor in a modular or integrated manner. As used herein, a processorincludes a single-core processor, multi-core processor on a sameintegrated chip, or multiple processing units on a single circuit boardor networked. Based on the disclosure and teachings provided herein, aperson of ordinary skill in the art will know and appreciate other waysand/or methods to implement embodiments of the present invention usinghardware and a combination of hardware and software.

Any of the software components or functions described in thisapplication may be implemented as software code to be executed by aprocessor using any suitable computer language such as, for example,Java, C, C++, C#, Objective-C, Swift, or scripting language such as Perlor Python using, for example, conventional or object-orientedtechniques. The software code may be stored as a series of instructionsor commands on a computer readable medium for storage and/ortransmission, suitable media include random access memory (RAM), a readonly memory (ROM), a magnetic medium such as a hard-drive or a floppydisk, or an optical medium such as a compact disk (CD) or DVD (digitalversatile disk), flash memory, and the like. The computer readablemedium may be any combination of such storage or transmission devices.

Such programs may also be encoded and transmitted using carrier signalsadapted for transmission via wired, optical, and/or wireless networksconforming to a variety of protocols, including the Internet. As such, acomputer readable medium according to an embodiment of the presentinvention may be created using a data signal encoded with such programs.Computer readable media encoded with the program code may be packagedwith a compatible device or provided separately from other devices(e.g., via Internet download). Any such computer readable medium mayreside on or within a single computer product (e.g. a hard drive, a CD,or an entire computer system), and may be present on or within differentcomputer products within a system or network. A computer system mayinclude a monitor, printer, or other suitable display for providing anyof the results mentioned herein to a user.

The above description is illustrative and is not restrictive. Manyvariations of the invention will become apparent to those skilled in theart upon review of the disclosure. The scope of the invention should,therefore, be determined not with reference to the above description,but instead should be determined with reference to the pending claimsalong with their full scope or equivalents.

One or more features from any embodiment may be combined with one ormore features of any other embodiment without departing from the scopeof the invention.

A recitation of “a”, “an” or “the” is intended to mean “one or more”unless specifically indicated to the contrary.

All patents, patent applications, publications, and descriptionsmentioned above are herein incorporated by reference in their entiretyfor all purposes. None is admitted to be prior art.

1. A method comprising: obtaining, by an access device, a firstbiometric sample of a user; generating, by the access device, a firstbiometric template or a derivative thereof from the first biometricsample; transmitting, by the access device, the first biometric templateor the derivative thereof to a mobile device, wherein the mobile deviceor the user determines if the access device is an authentic accessdevice; receiving, by the access device, a confirmation of a matchbetween the first biometric template and a second biometric template onthe mobile device; and conducting a transaction between the accessdevice and the mobile device, after the mobile device or the userdetermines that the access device is authentic.
 2. The method of claim1, wherein the method further comprises: transmitting, by the accessdevice, a confirmation signal to the mobile device, wherein theconfirmation signal is an audio signal.
 3. The method of claim 1,further comprising: transmitting, by the access device, a digitalcertificate to the mobile device, wherein the mobile device determinesthat the access device is authentic using the digital certificate. 4.The method of claim 3, wherein the mobile device determines that theaccess device is authentic by comparing a first geo-location of theaccess device in the digital certificate to a second geo-location of themobile device and determining that the mobile device is proximate to themobile device.
 5. The method of claim 3, further comprising: receiving,by the access device from the mobile device, a challenge; signing thechallenge with an access device private key to form a digital signature;and transmitting the digital signature to the mobile device, wherein themobile device determines that the access device is authentic byextracting a public key from the digital certificate and verifying thedigital signature using the public key.
 6. The method of claim 1,wherein the derivative of the first biometric template is transmittedfrom the access device to the mobile device.
 7. The method of claim 6,wherein the derivative of the first biometric template is an encryptedversion of the first biometric template.
 8. The method of claim 6,wherein the access device includes a beacon device.
 9. An access devicecomprising: a processor; and a computer readable medium, the computerreadable medium comprising code executable by the processor to cause theaccess device to perform a method comprising obtaining a first biometricsample of a user, generating a first biometric template or a derivativethereof from the first biometric sample, transmitting the firstbiometric template or the derivative thereof to a mobile device, whereinthe mobile device or the user determines if the access device is anauthentic access device, receiving a confirmation of a match between thefirst biometric template and a second biometric template on the mobiledevice, and responsive to the confirmation, conducting a transactionbetween the access device and the mobile device, after the mobile deviceor the user determines that the access device is authentic.
 10. Theaccess device of claim 9, wherein the method further comprises:transmitting, by the access device, a confirmation signal to the mobiledevice, wherein the confirmation signal is an audio signal.
 11. Theaccess device of claim 9, wherein the method further comprises:transmitting, by the access device, a digital certificate to the mobiledevice, wherein the mobile device determines that the access device isauthentic using the digital certificate.
 12. The access device of claim11, wherein the mobile device determines that the access device isauthentic by comparing a first geo-location of the access device in thedigital certificate to a second geo-location of the mobile device anddetermining that the mobile device is proximate to the mobile device.13. The access device of claim 11, wherein the method further comprises:receiving, by the access device from the mobile device, a challenge;signing the challenge with an access device private key to form adigital signature; and transmitting the digital signature to the mobiledevice, wherein the mobile device determines that the access device isauthentic by extracting a public key from the digital certificate andverifying the digital signature using the public key.
 14. The accessdevice of claim 11, wherein the access device further comprises a BLEstation.
 15. A method comprising: receiving, by a mobile device, a firstbiometric template of a user or a derivative thereof from an accessdevice; determining, by the mobile device, if the access device is anauthentic access device; determining, by the mobile device, that thefirst biometric template and a second biometric template on the mobiledevice match; transmitting, by the mobile device to the access device, aconfirmation of the match between the first biometric template and asecond biometric template on the mobile device; and conducting atransaction between the access device and the mobile device, after themobile device or the user determines that the access device isauthentic.
 16. The method of claim 15, wherein the derivative of thefirst biometric template is received by the mobile device.
 17. Themethod of claim 16, wherein determining that the first biometrictemplate and the second biometric template match comprises comparingencrypted versions of the first biometric template and the secondbiometric template.
 18. The method of claim 15, wherein the firstbiometric template is derived from a facial image, a fingerprint, or aretinal scan.
 19. The method of claim 15, further comprising: receiving,by the mobile device from the access device, a confirmation signal,wherein the confirmation signal is an audio signal.
 20. The method ofclaim 15, further comprising: receiving, by the mobile device from theaccess device, a digital certificate to the mobile device, wherein themobile device determines that the access device is authentic using thedigital certificate. 2.-23. (canceled)